I want to have a search for a particular keyword say "error" being calculated from the events and the output should be in the form of table which shows the count for the particular event for last 7 days and last 30 days.
append will add the sub search as a row entry, and eval works on a event row basis, so ideally you should not receive any output by using thsi query. Try this :
index=xxx error earliest=-30d@d latest=@d | stats count AS thirty_days | appendcols [ search earliest=-7d@d latest=@d | stats count AS seven_days] | eval rate=((seven_days/thirty_days)*100) |table rate
append will add the sub search as a row entry, and eval works on a event row basis, so ideally you should not receive any output by using thsi query. Try this :
index=xxx error earliest=-30d@d latest=@d | stats count AS thirty_days | appendcols [ search earliest=-7d@d latest=@d | stats count AS seven_days] | eval rate=((seven_days/thirty_days)*100) |table rate
What have you tried so far?
index=xxx error earliest=-30d@d latest=@d | stats count AS "thirty_days" | append [ search earliest=-7d@d latest=@d | stats count AS "seven_days"] | eval rate=((seven_days/thirty_days)*100) |table rate